4016dab3c637e065709589c2e9e0885e2ef0ad59bbc05f6bcc20c2336e1056f0

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
Size 13.3MB
Sample260629-vglbcaas5s
SHA256 4016dab3c637e065709589c2e9e0885e2ef0ad59bbc05f6bcc20c2336e1056f0
MD5 364aad8357bec0d900bce3569027f908
SHA1 e00d8779490ef2e620bc8acad9b0697e2336f350
SHA512 36faa5e9cf4ff98624c5aeb9530d0f15bba8f306627e16a6c2d00e212d4f17a123d2fbee7e57e8c9b3d341b36bfaf3a8167073a8bcca40c03adb2d22d21d3df6
SSDEEP 98304:jUvermWtt/ABPqELg38w6cMqHyznPlBZz+k2qCgk1tSIuHSs4IluPCJAnOudnEhN:jUamCAByELgwrFtwqPy6CYaBEh+k
TLSH
T11FE68D07E89605A9C4EED634896692237F70BC495B3027D72B50F7782FB3BD06AB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 11 IoCs

pid	Process
4512	elevation_service.exe
1612	elevation_service.exe
2516	maintenanceservice.exe
4352	OSE.EXE
3128	PerceptionSimulationService.exe
6016	perfhost.exe
4708	ReFsDedupSvc.exe
5380	SensorDataService.exe
3428	ssh-agent.exe
1180	AgentService.exe
2472	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe

Enumerates connected drives 3 TTPs 50 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\F:	explorer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\e5eb51e64a0960ed.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	elevation_service.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-sk.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-tk.hyb	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_1080810562\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_1080810562\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_1080810562\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-mul-ethi.hyb	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000000ed9f76e807dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009bc3cf75e807dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4v	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e15342b6e807dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msconfig.exe,-5006 = "System Configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b6eec975e807dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c184dd76e807dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{EEC8E6FD-D506-481D-B4E2-0592158475A2}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{D24995EA-5BD0-4A20-AD00-E25FFE524F1A}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
884	explorer.exe
884	explorer.exe
4512	elevation_service.exe
4512	elevation_service.exe
4512	elevation_service.exe
4512	elevation_service.exe
4512	elevation_service.exe
4512	elevation_service.exe
4512	elevation_service.exe
5608	msedgewebview2.exe
5608	msedgewebview2.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5360	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
Token: SeAssignPrimaryTokenPrivilege	1180	AgentService.exe
Token: SeBackupPrivilege	4708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4708	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4708	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4708	ReFsDedupSvc.exe
Token: 33	2472	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	2472	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	2472	SearchIndexer.exe
Token: SeDebugPrivilege	2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
Token: SeDebugPrivilege	2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
Token: SeDebugPrivilege	2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
Token: SeDebugPrivilege	2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
Token: SeShutdownPrivilege	884	explorer.exe
Token: SeCreatePagefilePrivilege	884	explorer.exe
Token: SeShutdownPrivilege	884	explorer.exe
Token: SeCreatePagefilePrivilege	884	explorer.exe
Token: SeShutdownPrivilege	884	explorer.exe
Token: SeCreatePagefilePrivilege	884	explorer.exe
Token: SeShutdownPrivilege	884	explorer.exe
Token: SeCreatePagefilePrivilege	884	explorer.exe
Token: SeShutdownPrivilege	884	explorer.exe
Token: SeCreatePagefilePrivilege	884	explorer.exe
Token: SeShutdownPrivilege	884	explorer.exe
Token: SeCreatePagefilePrivilege	884	explorer.exe
Token: SeShutdownPrivilege	884	explorer.exe
Token: SeCreatePagefilePrivilege	884	explorer.exe
Token: SeShutdownPrivilege	884	explorer.exe
Token: SeCreatePagefilePrivilege	884	explorer.exe
Token: SeShutdownPrivilege	884	explorer.exe
Token: SeCreatePagefilePrivilege	884	explorer.exe
Token: SeShutdownPrivilege	884	explorer.exe
Token: SeCreatePagefilePrivilege	884	explorer.exe
Token: SeShutdownPrivilege	884	explorer.exe
Token: SeCreatePagefilePrivilege	884	explorer.exe
Token: SeShutdownPrivilege	884	explorer.exe
Token: SeCreatePagefilePrivilege	884	explorer.exe
Token: SeShutdownPrivilege	884	explorer.exe
Token: SeCreatePagefilePrivilege	884	explorer.exe
Token: SeShutdownPrivilege	884	explorer.exe
Token: SeCreatePagefilePrivilege	884	explorer.exe
Token: SeShutdownPrivilege	884	explorer.exe
Token: SeCreatePagefilePrivilege	884	explorer.exe
Token: SeShutdownPrivilege	884	explorer.exe
Token: SeCreatePagefilePrivilege	884	explorer.exe
Token: SeShutdownPrivilege	884	explorer.exe
Token: SeCreatePagefilePrivilege	884	explorer.exe
Token: SeShutdownPrivilege	884	explorer.exe
Token: SeCreatePagefilePrivilege	884	explorer.exe
Token: SeShutdownPrivilege	884	explorer.exe
Token: SeCreatePagefilePrivilege	884	explorer.exe
Token: SeDebugPrivilege	4512	elevation_service.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
5392	sihost.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe

Suspicious use of SendNotifyMessage 43 IoCs

pid	Process
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe
884	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4192	StartMenuExperienceHost.exe
5292	SearchHost.exe
884	explorer.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 5360	2736	2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe	90
PID 5360 wrote to memory of 5924	5360	msedgewebview2.exe	91
PID 5360 wrote to memory of 4796	5360	msedgewebview2.exe	98
PID 5360 wrote to memory of 4796	5360	msedgewebview2.exe	98
PID 5360 wrote to memory of 4796	5360	msedgewebview2.exe	98
PID 5360 wrote to memory of 4796	5360	msedgewebview2.exe	98
PID 5360 wrote to memory of 1008	5360	msedgewebview2.exe	99
PID 5360 wrote to memory of 3716	5360	msedgewebview2.exe	100
PID 5360 wrote to memory of 3716	5360	msedgewebview2.exe	100
PID 5360 wrote to memory of 3716	5360	msedgewebview2.exe	100
PID 5360 wrote to memory of 3060	5360	msedgewebview2.exe	101
PID 5360 wrote to memory of 3060	5360	msedgewebview2.exe	101
PID 5360 wrote to memory of 3060	5360	msedgewebview2.exe	101
PID 5360 wrote to memory of 3060	5360	msedgewebview2.exe	101
PID 5360 wrote to memory of 3060	5360	msedgewebview2.exe	101
PID 2472 wrote to memory of 4500	2472	SearchIndexer.exe	104
PID 2472 wrote to memory of 5416	2472	SearchIndexer.exe	105
PID 2472 wrote to memory of 4272	2472	SearchIndexer.exe	106
PID 2472 wrote to memory of 5704	2472	SearchIndexer.exe	107
PID 5392 wrote to memory of 884	5392	sihost.exe	112
PID 5360 wrote to memory of 4952	5360	msedgewebview2.exe	121
PID 5360 wrote to memory of 4952	5360	msedgewebview2.exe	121
PID 5360 wrote to memory of 4952	5360	msedgewebview2.exe	121
PID 5360 wrote to memory of 5608	5360	msedgewebview2.exe	122
PID 2472 wrote to memory of 696	2472	SearchIndexer.exe	123
PID 2472 wrote to memory of 4592	2472	SearchIndexer.exe	124
PID 2472 wrote to memory of 1424	2472	SearchIndexer.exe	125
PID 5360 wrote to memory of 5568	5360	msedgewebview2.exe	126
PID 5360 wrote to memory of 5568	5360	msedgewebview2.exe	126
PID 5360 wrote to memory of 5568	5360	msedgewebview2.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2736.3272.18393433990082077089 /pfhostedapp:59741e04111a029e970d24d3f162bcd7cdf7b26b
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5360
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView /prefetch:4 /pfhostedapp:59741e04111a029e970d24d3f162bcd7cdf7b26b --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff970325fd8,0x7ff970325fe4,0x7ff970325ff0
    3⤵
    PID:5924
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView" --webview-exe-name=2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1940 --field-trial-handle=1944,i,8348047410616092597,270315765397739479,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:59741e04111a029e970d24d3f162bcd7cdf7b26b
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView" --webview-exe-name=2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2400 --field-trial-handle=1944,i,8348047410616092597,270315765397739479,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:59741e04111a029e970d24d3f162bcd7cdf7b26b
    3⤵
    PID:1008
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView" --webview-exe-name=2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2460 --field-trial-handle=1944,i,8348047410616092597,270315765397739479,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:59741e04111a029e970d24d3f162bcd7cdf7b26b
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView" --webview-exe-name=2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3520 --field-trial-handle=1944,i,8348047410616092597,270315765397739479,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:59741e04111a029e970d24d3f162bcd7cdf7b26b /prefetch:1
    3⤵
    PID:3060
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView" --webview-exe-name=2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=1944,i,8348047410616092597,270315765397739479,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:59741e04111a029e970d24d3f162bcd7cdf7b26b
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView" --webview-exe-name=2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4388 --field-trial-handle=1944,i,8348047410616092597,270315765397739479,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:59741e04111a029e970d24d3f162bcd7cdf7b26b
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5608
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView" --webview-exe-name=2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4548 --field-trial-handle=1944,i,8348047410616092597,270315765397739479,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:59741e04111a029e970d24d3f162bcd7cdf7b26b
    3⤵
    PID:5568

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1612

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:2516

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4352

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3128

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:6016

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:5380

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:3428

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1180

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2472
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4500
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1086369643-1618123105-2567081378-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5416
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4272
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5704
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:696
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3020 3032 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4592
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3052 3056 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1424

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:884

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4192

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 7c6cf8fd97b10defb9828efb3b5866f05de48edb0c5d838cd25d55c9a9533017
MD5 6c02c3abbe43dddd1124b2cfa1e4c51e
SHA1 8afb9502a2db4a29af989a578006ae82f7d98ae4
SHA512 87861f7aac7947cccee4eed9814d0c507b3eead08027f0369372d96182f75c930ad2e295a603177028d411c3636e073b3482d9c09a39ecc06347cc61825bd7b1
SSDEEP 49152:Qb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn+B+kn3Hnx:63q6sjBR+k
TLSH
T108D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 e5e3f9db20c6485c0b611aa0e84c7002a3ab1051da838d853d9d229c2513fb36
MD5 670cdc2c57079667b60452213a7dfdbb
SHA1 a42940f10e7b2fa315cf93e01c55619040b0b269
SHA512 6d3368fc879bfbdc9393402b3c0e13cbef31780cc962523cd6924489588aa2fd906a91b5b0c41020ba2a82bf653573faae91e49c781d0f86c50fdb5f0b27b2e0
SSDEEP 12288:/1XLsswWkxy2lRq2czAjLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTQ:9XYfDtczAwNyBo4kx929bL3Hnx
TLSH
T1AE65012867D409F9ED6B9278C8A2C511DA33BC4547A0E7DB03A489761F337D85E3EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 6d858f2fbc3d0e17beba6e27444ed24eccb68f58b233947e97c177f798eb9f2a
MD5 4031b213f1ccf6d6a29f7556db35b7b7
SHA1 a3e4be06d6bf721f5c4d905e9c94feae815251f6
SHA512 965dd1f446d5e4fc0cdb1005e26cae32e2204f0e61bf16b399d27fb752ce6ab8b8658a631bd29b8d50229bc4df7590e1c3482bf643259eb1106150cb1acb355f
SSDEEP 12288:TXZNYVLeyUji0h90ZD0wxpGZIVuArHsaLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2i:F0Le5ji0hmxfrMxNyBo4kx929bL3Hnx
TLSH
T16B859E16F6788335D073C0B9C5D2A69EED7130861B308ACB4286D77C7E67AE68636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 37c257d69de730c3ab053f73e0a08293197c8ca83b395cf2854d709d07f970e6
MD5 cbb78678f05c33c98725f4d68aeb183f
SHA1 15f55dba264c441865ff95cf1222937a6c6a05e2
SHA512 dc139527714f0ea9532ad1f11c0bf95a53348242ed60d222b7358f175d07f76cb44abba5c2d9998f3d931f8a7560e72caee6bb706ce7a2262d9db2b2cfd5872b
SSDEEP 24576:ba7/ezSC6vUyD/aqgrvWn6q8wyurNyBo4kx929bL3Hnx:2/ezSC6vUzPveHjyJB+kn3Hnx
TLSH
T139755C25F5788323D0B2D0BAC5D6AA99FE3230465B3089DB0246D76C3E277E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 0b7abc858663f5081258954bd034c70205dd03d1ac91d4a715d5382ae8a85bd1
MD5 9fe44649db362921d2f693d7c007c9d3
SHA1 8090b8ae2bf295695c0cfabc3da59359f08accf0
SHA512 b2aa225d30276b0ef1e560ca6f2833be2885ff3f81550993f953c327b0d6a5c078633b6e63185cb5aea1354a0cd3ea71d8311919bff875f53f120b94bebde7f4
SSDEEP 12288:+VJjBq33vb5O8M+l1D0hwsEBoW/lx4of0Im98nLDAptNyvUgXZ32dT4ePc7N29CD:+VbqPb88hv/l+YcNyBo4kx929bL3Hnx
TLSH
T196559E66F5748331D073C0B9C4D2AA9AEE3234425B31CACB1246D76C2E67BE6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 e7d916c77bb12287d6dc49026ac5ff73d221d554109eb77d186b9ba467aa5b6e
MD5 58764afae0bc976169fa8adb0b14be36
SHA1 abfece9e8f2366336fb2e1c8f90b27be05ebdf85
SHA512 d854ae536e8ce5b0717375a74b0bcedd95f2d65666980a97235d573fe4fad925c7855dbf37568d40356fc0a9f73786d4aac5d40c6ee948dcf8601356ad6d963e
SSDEEP 12288:Om+LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:OmNNyBo4kx929bL3Hnx
TLSH
T1EC4523124B0C627AFBBD3F70745E8454CC35BC8D0D95DB98DE62ACBB58BC9A2DA21107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 8a4eeb62702a27380f02afe3170f0b5e85131089408b9dd6a28190beeee39cd7
MD5 e3dc5360b9aea04a967dce68a78a5e22
SHA1 d140236d9ed0a02b5248a1afbb453837f6b49ff6
SHA512 b39765675da04c74c77a0a074f46d97475ef17ea2747521cb638b1a9d75d06a2e5698b79bbb8668fda0db7ff7054b05f675114532d4ba96d58cb3af526f782f3
SSDEEP 12288:CeBNUbTVO86UPLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:CJIU0NyBo4kx929bL3Hnx
TLSH
T12765CF3BEE28FCE2C27E5DB85A918600D77278304F62A3CBD165821EDE235E15E79C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 bbbb0f2ffd2211c8091a1f6e3a5c2120b14c96803d8bf209180a6fdece9a97a7
MD5 e197fa6d0939272244007603b2e7f42a
SHA1 9cb34d260de23eac4ba30408f3465a9b5ebda844
SHA512 e3633703e7b7825b53c836f3de59c9b93847d9eafbe75abfa14391905ab20e7a3f6466d2b05460330ad0fd64a8196df17d7f705ae522892e6b0f4f8d82b09deb
SSDEEP 49152:IQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH1:IQvGAdlCEL8c/DRNw5Co+k
TLSH
T13A266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 a1c9d3bddbce22d1f1660c75da5993aecc0b618b6f7eef96559feeaf96a36f2b
MD5 bae854592408bc57a533f934f208e547
SHA1 ee7a21ed2c0d7415a8ae672cbd2a23a7d967afea
SHA512 b8242821ebe12a65de33767dc59b7c53854602c4d38ca5570e07b4f4cabdbc3d247bfb30724514479919ca41a822317f932a6f3fc98f880bd3c7c6a40db88cb8
SSDEEP 12288:gAwSfxL/2Dc3XDLLmt0LDQewsAj5LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxB:1OewsAjmNyBo4kx929bL3Hnx
TLSH
T10E75E031FA74E036D7BF0DB11B26C716583CB9204F611AC3E3A88DAE59742D22776A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 a5803a8392b9eebc39a5997f568524f6ed08ed574bfbd5a3070442b8d6e5f8d9
MD5 a11e7c9bfe91592632f2311357f6d47a
SHA1 1c45ab118a6178da2de2c220bac8aa2faf4d19e8
SHA512 722a0ce25f528e10ca755d482bd2b87365378aa8969784b423ff2caf7ce77aa1e8fe80af265f37d9268abe74eb2ceabefecaa6d7f0d799295f4aa54acd6e88aa
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHz+k:vUEtQevvqc2W1cpV2tI32z
TLSH
T17D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 715cefa87ac3a2910d4fc6e0905a36fda6d929ddee61e01a530eb7ee02e74b1a
MD5 4bd6bf76d93c0ffb5d7f514561d7e1c8
SHA1 2f1ce8b809abba2ea608614c926860b77a1fa0be
SHA512 8d6c67741d0e17ca85f23fd36576d9762db734209d163b2779049e9c251b0c83f73715b63face3c799a97ca84dae577ad2d1f44601a7f1fbe28e19cb581897e0
SSDEEP 49152:dCbRquA/m2yL5zTfFiV+XenmE3/ztB+kn3Hnx:aoquVjnmM+k
TLSH
T196D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3787e402b66396dcac61e4062037766263674dc74cb8a820db10db8cfe836b47
MD5 3f61b3a660426afdb9af909ae5329039
SHA1 523a8d51f3dcf697eb36ea891df392bd92b1d6d2
SHA512 b40be539d856ca024bca590a0537a9c44f70d3577d0f33027c14d4d5986ca566946fca207d48d2116466b16a0050fe014be0e6eec7fa304fe217cd57559c91f1
SSDEEP 24576:8AhGL3IFoiwtA5l7S53/NyBo4kx929bL3Hnx:8AMUFoiq5gB+kn3Hnx
TLSH
T15C359E81E7F955D4F5B3AAB899B68170E976BCAA5E31C20F2160D11F0E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 194c69afcc2a8b81619d675d316da2ff8e02b21ca663bcacc50b4b281d2ee269
MD5 b1987b698877578a6f1870ead129d477
SHA1 ff9110bce7714fbc758b27e608947655173a8290
SHA512 217df7719601c28b26f0d0a2dc6c387bc88dafcbfe9de48f51c7e0cd2e8c048d4b2d8ec3d6ae168e159c26fc7e21f701f213bd6f200d25020465a6e7084b3edb
SSDEEP 12288:Qmw5HEjsChNzBFgl0WDm+CULDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:Nwu6OW6NyBo4kx929bL3Hnx
TLSH
T1E465010677A81CF9F96756388547C136EBB2BC022A21DB1F4760C66B5F37361AE2D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 387aaa56398424398b6d53673a56147a0ef09d104f0aecdb251c50ce202c0fd0
MD5 1644395a7b21d83e696928ce4639e0b8
SHA1 04495af82640d02ebca5bc12b4885e6c5ab16112
SHA512 b695a9a90dffcaf87a198a697885efc48cb79ae29fff2001b852471040cb11b7f725bce811a84feda0f281212ac802f37409e6024bcf51fa98bbca2fc18ab973
SSDEEP 12288:kgZ1IypLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:bZuJNyBo4kx929bL3Hnx
TLSH
T1F3551216239831FAF2AB2678D8E58544CB32BC461B7183CF5A2146BA1F77ED25E35313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 816794f01f0ae09ffec8179178b353edc245499d645b90180185118df0c0e97c
MD5 9f6c8f4189a4859b62ca94f441898664
SHA1 3e73da12c7d8071f249e79ac787e38fc61e6d6ce
SHA512 2934ede7157b1dca88c920a6bd255b764b8035e6c067ceb089cc174ad5838a855b5e15c19692f86bb7020db8131cd6949f1aa21e9235622168450ce87784cb89
SSDEEP 49152:Ej8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Up:bQRQyi36YOcPbLvw2gAf+PN39+k
TLSH
T150666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 2bcab896971a6105444193fb2e4d43f8563b4664267dd9324ba690fd2ba91f26
MD5 1d6449f5fc7f900e91c2f50b665acac2
SHA1 c0a9b171512e1f3c3dbf97ef1e46fc6f99c8befc
SHA512 9a2f7b2e30ab912541a3bab170aff22704f73342ebcb2a1c29f7b5b1c6e4e7f82d60493c6f26e0f5f0677bb9f44d8487cce62c49aa6ae2990d90475e0e132aed
SSDEEP 49152:uj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23Up:dQRQyi36YOcPbLvw2gAf+PN39+k
TLSH
T1C5666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 6c3a372cd0a143ea1e89cc2f72940cfd24b0dffeafb187244902cc4148570759
MD5 3fce5af9397c524d27d2056ad4a376fa
SHA1 4a88af7ec0ac0324c74c4fc6c4877980af376dd9
SHA512 9e34d043206eaeb632f263fe28cb3caad8f524fe144423e91493a164ee63cc1cb8afa200226dd94ff70bbd313641fc376e9dbc04bce256bdaa3645d5492a0f6d
SSDEEP 24576:awvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL05NyBo4kx929bL3R:U68Qg55nhceWu7PNU3/dB+kn3Hnx
TLSH
T142B55933B2F600A9C44DE1769F4A873196E17C758FE0E3DB851172161BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 283559611557eeec8e121873dd0e4e3e0e990dbe59449099cb2726a90f166f21
MD5 e11ba88ce2bf5f61271c82911ef45435
SHA1 c42db1c3e8522e9de8f93a691a983d4caa664feb
SHA512 959f6796574e0da1e82c77437a619c7a9787c81e3c98e511a63366cccfda3d58ce32b83b0025717d243de439a31b07392cae945873b3577227a2df7f98503ab5
SSDEEP 49152:s3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99T:Jy5112gYy5azzVvt69nLKnhZi+k
TLSH
T17E167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 793b5cfa042a1479f52c3f2d237ca2517ad61e593591ec49134356a50008c487
MD5 870e5b0989a64ffcce90e3512243e8d8
SHA1 981919899280ab077370949cf2da8f98d8e2210b
SHA512 df94289eea1a9fb56a4cc8f70b266349cf9df3b0be4a099cd98182c8a9457e66da1b3ebdc6f8fc4c6daeaff04c89b5857113f3ffde3b79641bfddd78ee23ac0b
SSDEEP 49152:jB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glTB+kn3Hnx:Vu6Jmdxd2dV+k
TLSH
T1E5D5AD13F1DA01E8D06ED578974A9233E962BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 8959252cc6cc12698d34cb70a9c481926838d0bc890b846c4db6387d313aa932
MD5 3c4f80aef2f37b93b41e474a4306b8a7
SHA1 27f17f6a1f0a49bdab364225824ad2192a73a840
SHA512 385668284585a061aa068a8f42b73398bd35e6589507efb7916c3c7e65e8af04d5a610affa10d3d340a50d292f7f845611dd47c8b75949dcaba0842897ddcb99
SSDEEP 49152:D1hpsNoJpF1A63U44CwH7R4xvB+kn3Hnx:DmifPWRM+k
TLSH
T1B4B5BE13F29801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BFE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 2d2ebeab7f23ba501b08626ac1d51b9f2e714dcdb256d84ce0e37b2ad070f806
MD5 752ca539617ad8b5585d5bd2f3c92fb5
SHA1 9938f78507802438729faae59073827d84d6ef04
SHA512 7cfcf19b03c6dcfffc04377003823890ca81d32e503f403274e0d33f5b1eeac1b09c00acf77aea8d872ca4ada336cb03ae8660af64e5ebba443f900c994b3799
SSDEEP 49152:OSuZQIY0Be2KcRVtOnks6NMHquB+kn3Hnx:A5dKii61u+k
TLSH
T159C5BF03F2E941E8E0BEE67487669232EA72BC464B34A6DF064072551E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5dc6623d2dc962ce07879e12e7c60faaa8de8df92fe8f767b29f2b32961ec082
MD5 59071f82391dc68c34145967710ac9bc
SHA1 f072954d84273bd6fbf054b028d579ccf0b8365f
SHA512 e4583515faa4bcad3a3d4af2492ff782893b648e32322bd18ac44462e2f6570ea7101854b781cd26c39fcf583c6523599887a6d9093f7c25e7decfcd3cc7d999
SSDEEP 49152:mhtSn8EApI0fig3giDn0AP5wDB+kn3Hnx:nX2imphQ+k
TLSH
T19695BE13F2D901E8D05ED178C7468632E962BC160B35BAEF0A90B6561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 63555d4fc7feb7939e9a206607f4a129532580af14794427dbfc9756170a14e6
MD5 4e0227a63f9e835ec2634679ba3e98a8
SHA1 b43c1b35b58981a2ec4b2d8ee30d7a63860af952
SHA512 4f3ba22b7847cc19fb1611fbd8c746e78308f615cb428fa46db177331d032a78d70c38bb45257c83e188f26959e2aca8cc51c044e87266a0bac7b2a75a4fc47e
SSDEEP 12288:JmLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:JlNyBo4kx929bL3Hnx
TLSH
T1794523125A0C627AF76D3FB0644A8198CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 c9265ef4b6a153ab894bfa99e82a4718cb857e333cc102145e0ce8b4d1c71c55
MD5 a93b3b59637da306fab1aba9e4a9534a
SHA1 b14ea08c95cb75cc6b1de60ba93dea2b7947162d
SHA512 5f57edd59ef37dbd82840e2b150e13c2930efb493e2243f9e0d33683e28a7016037631d3b8b431ec9c57aaa5d8293cccc5c1876bd1390379230dc13ea1549360
SSDEEP 12288:x9LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xiNyBo4kx929bL3Hnx
TLSH
T1534523125A0C227AF76D3FB0644A8498CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 e0fdd327b12783d25b48e8727ffe941dbba58be15138014f7959912412c54931
MD5 349b69023d60e514ab8e67d711b410ec
SHA1 45c090f34d631765ecdcd00f51d92e53a19ad035
SHA512 6bd2f3c2ac0e12c7758da488f8a21db6db9acec602087afacd512bbbc80b4ef0da44ad3b63c8fd87eb696c3e61b854345d600414a7a00890e8d23f880f992776
SSDEEP 12288:w3LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:wMNyBo4kx929bL3Hnx
TLSH
T19B4523125A0C627AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 626eb861d0b257b75ec594c6a1b608cf40e6e0d276b79ebbbd1694c29033deab
MD5 6e49aef55a08372cba113696d01726f8
SHA1 aa2b8ba1c4551690e873789eb8625c79c0c2295b
SHA512 771ec6fb313fcb0845a5235e64c79fdce442ac6c31d2ee12777c7ecb762f6edbf7e29246290ce824171118e6be51a711ca928e912696f9c9cc561eae5b73c95e
SSDEEP 12288:QVgLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:UNyBo4kx929bL3Hnx
TLSH
T1244523025B5C12FAFA7A7BB098568054C835BC8A5B7197DFDF124C7B0EB9BA15E30702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 78c3f1fba6c3c74d78a5de80fe1f40e5178b728f58ffb33e209d7910e086c7ae
MD5 789a9a2928c1b541924dd7f72209bd78
SHA1 0e70b678ca5fa0c38d6add7299300413b15755f5
SHA512 63731d783cda16f672a0b0caa6fff0ff1beaabf8431cbd548e89182e2f7affce00b1b3cb635ac58358a8de625d35f36f452271adb63c753be97500db7e27f8c9
SSDEEP 12288:DYLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:DHNyBo4kx929bL3Hnx
TLSH
T1AD4523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 80504029b56e90e54e93d05b980545c278d31eae28a703e450d892d614c165b6
MD5 949aa77602264d2e17eaf66d94a9aa6c
SHA1 891e856a8915a380c090147ff7980c91a5387bfd
SHA512 af5ca50234defdf84b327d4e066edb709d3a1f16c6099c8a773e51f79c2c4eb625f6da788dd571e72046f8b050f90b53941e97c7225d611805258170c6f89d5a
SSDEEP 12288:xhLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:xeNyBo4kx929bL3Hnx
TLSH
T1374523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 88dd1549743a5b503aeb830c8831ef1c604e5f3263d52a76259f0e37115322c6
MD5 db6b41fa6cd8135f463a2157f32ad52c
SHA1 1fd9a23f30ae45c3ad2d8510f65c595e27c404e6
SHA512 07ed0ce7138dae235239403a33562eebc3a98501e00c91c9bf01207005881248235ef8947dfac901bec16bc959c63421267c1ecbbef59f11b7b4fdeb0eb4abdd
SSDEEP 12288:61LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:6qNyBo4kx929bL3Hnx
TLSH
T1D34523125A0C227AF76D3FB065498498CC34BC8F1E95D7D8EF27987759FCEA25A20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 7647273b406f332a0da795f27d5cb7fb1e4fd414cea1393bf51dd2723dabca92
MD5 547e47c7d2abd89a27e6f9f3ba9b8253
SHA1 a441a8b79579a675e665dfb2ee10ef9b54076608
SHA512 a30dc00382fd8a6a488facd481a7310ab2380b79b28e161e2e5608c1afc7b10832fd77977bc896ca4a1e2b6a6bdbad5f45387b53cb35325ec2e25cabdf6113de
SSDEEP 12288:XiZwbjzzFEoS2cPvydLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyu:SZMXzFVSOCNyBo4kx929bL3Hnx
TLSH
T1E1650195B39418F8EC67823DC8158906C6B2BC4A0BB0C65F07A4367B5F773A11D3EB96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 f2343870ea9326024dd58166f6ad300acf4aaabd9c999a5009b9f9b412eae189
MD5 986c3f95558367edccbdcd857714ec83
SHA1 5c08b6a249764a37c8e8190ff29326c9ddc17f10
SHA512 e34b3ebe5c0ce322c996720a25dd418f6c69ec8585866f4e515afc16a033c9357b5da1a7670bee6c38b83fda4425f2157c914664b0b69a0098784210b69ba150
SSDEEP 12288:myLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:mZNyBo4kx929bL3Hnx
TLSH
T1584523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 6819c9ece4efce1a5691af34bc94d86deec734c55dc94aff422b51b3622492b0
MD5 e88c7f0bec239923a258fbe87c4e73a4
SHA1 fcb47b6f2aab44d38dd27d1fce2fb5b80a89bed8
SHA512 1ba42931e7d1590525f261a69d421300e8395668a865e028a6c4fa27ee2953b8308030fdd39cb4b3a061fb8f3c14f48f0f22e58abd516b326f1c518ef89069ce
SSDEEP 12288:NuLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:NdNyBo4kx929bL3Hnx
TLSH
T13A4523125A0C227AF76D3FB0654A8598CC34BC8F1E9593D8EF27987759FCEA25B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 f1539ee98215ac00722646fe20cd76f96d21963fb31edf03db4354c65326476a
MD5 21e8120a7afe9f3a360104c2f3d1a406
SHA1 d00a50fed0074a01ed530f1a5fc99f1deefd8fd8
SHA512 488bc0fd4a0d519dbe764544dff9dfdd75f184af230b26bb4407cba01e7ca8a16a3412ced3591bb1388ec3c50308f7e08b038f638db7fd530ff0c12b0f4b20f6
SSDEEP 12288:MyPz5L8pLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:Vzy2NyBo4kx929bL3Hnx
TLSH
T12855120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 187c825bb4c53a84cf2222e8a7eb0f4e994f67efd044e81540a47ce5fcd3fa2a
MD5 23b8fc416091fa037ae0ffcc867feec9
SHA1 77a846c23f7178390bed14b5976cb1c90a2e6db6
SHA512 4b78206d4f88f7e9ae594452412517ce201c55574443cf3d32ae1743bedfde7da07181019dc39448959c193f4aded047933e80d7fe4133b834eb82889538bea0
SSDEEP 12288:RyLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:RZNyBo4kx929bL3Hnx
TLSH
T1CF4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 4b114f1bf647e19840bbbc20c15bfb2e564bffd276663f7ae5c8e2bb386e91a0
MD5 3c9220ddc932ea28990618afefb6cb4e
SHA1 ecd0291b1caa848a67046f41bc639292e5a0cf49
SHA512 574c3f3857b706aa793007d8547ad37d70cd90a91f5cea897be898691ff246fc91a067807ffd25774751ffe4b51febd2042d6062f7c1fbefe477dde4adf25068
SSDEEP 12288:lyLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:lZNyBo4kx929bL3Hnx
TLSH
T1AE4523125A0C227AF76D3FB0644A8598CC34BC8F1E9597D8EF27987759FCEA24B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 37d6dd32dfbfbe5a3e01c2cb07743fd59bb044f5a1c9cca8f335848f419e07ab
MD5 93e36dc8de73055abef706a515906096
SHA1 bca0721af43f8762f27b675fc71f4872c92306a2
SHA512 d6e3d87ceb4a032f75fcea07ec9fc1a7d5e2842cb2c59c73daef0c0921db236394d2b51e16abd26669bbd52c5f51331c575da4d8d146d64c3687064b92e0acdc
SSDEEP 12288:/yPz5L8pLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:yzy2NyBo4kx929bL3Hnx
TLSH
T12D55120777A831F9E17A6234C8960A05E731BC360B608BEF576046771F7B6E19E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 bb17872ea1c7b7441421730ecc8d678350dcd38a14a2cbe5c23d04102d6d790b
MD5 7cdaff93d6be38a0bf4dff0711a86fc4
SHA1 f32491646ade9c2e82e99a22a0f695148afe27e7
SHA512 291275cbaad15fe6e5bd1c2173241f53096442d5fbc9b30d0918996ee521d2062df12d183856ba25221565486e88f9b0374c40cac1b6d585b4352d64f6275a8e
SSDEEP 12288:mCd98WYoaLHF3z0z04PDvhHLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHz:nTtaLl3z0zD8NyBo4kx929bL3Hnx
TLSH
T10C6501A5B35018F8EC6B823DC8568906C5B2BC5A0B70C65F07A4367B5F373A11D3DB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.6MB
SHA256 f6751a94170c0785d4415c9742000f30fd1abcb86e3c0d0516776b8ffd7b822e
MD5 37f9c0c5b394a6a1711bb288bbbe979a
SHA1 82c490d68e6db111479245afada6285533b32234
SHA512 1c151a641e783e53215d23ea138821943a0b8365909a52a8f9a8f11426f52dff0b01b53f9c9bd9531b1744bf545a107aaad52ed4938b691d44bff696d97badc8
SSDEEP 12288:Oi4e7ARdTfgwCHKy7GLbbdIvMLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53T:O3ld9CHKy7GZINyBo4kx929bL3Hnx
TLSH
T17C75CF90F3E810E8F1B79A3489764511CA767C9A1B71DE8F03A4656A1F33BD18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 b6d46907b534308f1cba496799fc427d3054c271f9694e13b0ca5583abc25452
MD5 649b271d085b4ada3f2eb1420844aadb
SHA1 ff2a555b8d8d4e39b9f03ab0c46a9539c43e0144
SHA512 7e8b3021aacf4ecaa025bedd6831d6c06e9bef6e6bd8d8c6138067780d4c149aa9f34824ee663db8a4ff0a33910f91c899265bba97f8b9d026e32c30174e77fa
SSDEEP 12288:uXLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:usNyBo4kx929bL3Hnx
TLSH
T1E74523125A0C227AF76D3FB0644A8198CC34BC8F1E9597D8EF27987759FCEA25B20147
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.2MB
SHA256 688f6e32c5d028269ba8ca4b94e2146210a6de2d7e156896c5985820f90f7dcd
MD5 eb831d5f8c6e9a7aa67b850ed7d7adc2
SHA1 50a0ab1976defd4bb8b16a95db73bfc8520f7482
SHA512 56a0d635ad067c0427fcbd1c1e211b879d10b06095317368473049d15b16132bfc162e543e3b1c118437b1a314c37b3e789cbec78537aa62956531864d03be73
SSDEEP 12288:EJLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:EWNyBo4kx929bL3Hnx
TLSH
T1C14523125A0C227AF76D3FB0644A8558CC34BC8F1EA597D8EF67987759FCEA24B20107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 7159583e8c44c82e5fb0ea95c3454ca6f51ba98e3b9f084c330c0eb192053d6d
MD5 53c41869a463d2e92fdebc03c8e7c458
SHA1 2e29a14561d29fd757e41f4ebabb4dfb6093c66d
SHA512 52b5c843612c82cedd525635bcb14449e6bfb21ab8867b07d7403fbd00a5312121939178bdda1a81f795a280a355f77de6b84477a7a2af1d75ffc2d28a5458dd
SSDEEP 24576:Lfwvqk9RX6wkyAItNyBo4kx929bL3Hnx:PMnYIKB+kn3Hnx
TLSH
T14B85DF29EBDC04E5E1B7923C99A7460AF6B178591B31C2CF029A53BE0E37ED05E39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 1c6c5dbe11ae6446f8f9cddfdaa09016e260893774b0ce75df33ddf7f712ae3e
MD5 80f91b2b1751b14fef877fb504e2d9b3
SHA1 2aa6c69d59d3d4183ae8b4f19186b7f0f7dd54f7
SHA512 de691cbb0487adafbb94b6fd60927806e59fb71e4f77b401e8e28e88f38cc32525db6dc21776953497a0c3dcbfdc92a1a0eb59485265a13aa5b7f2804dce3277
SSDEEP 49152:rYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0jB+kn3Hnx:uySzPd+k
TLSH
T1C6066C56A1A801D9C1B9C1B98F1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 dc30c50734b609d1229654ec4ed6ca6a643df5c1e12a0d4fde22282e87fd2130
MD5 869e8c0fe2513c2b3aa1a38217c07863
SHA1 eb6802f0595fdce8196fe173a8f4a775fc8fe1c4
SHA512 433eb6fe96c6c45c5059dca28154b5ca3bb6eea1db02036180ac5b43e17779fa6ac077a5a185cd1082fdfd1b9dac3660e447e69248701a975628db7d0197dc9a
SSDEEP 24576:v47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYSNyBo4kx929bL3Hnx:v47JUQjTirIhCnDHUPfF/TB+kn3Hnx
TLSH
T11765AE1EA3EC01E5E1BA927885154A5AEA71782E1F31CACF1270837D6F23ED45F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 8fb3873c498e28a14b34db4fc4b01a13eacd7c9cb6ca8b6216877b5d9d0ece84
MD5 d0bb4a2dc09bad9eb5a6bef24acd899a
SHA1 c8e7886a988b8ddb8c370729e7c9d695bb135038
SHA512 d5140c8c88b05d4310b6206d62e24ec2bb34c7baf07259acc452a768eef0f9c5eee226c8d20e864092a23e070da3ffae9821f319d8a9487e20dbfa5b4db794b5
SSDEEP 12288:tpsfCLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:6JNyBo4kx929bL3Hnx
TLSH
T17A55F01AD25812E8D16E2274C7468A40F7337C5947E1D3CB97D0F87E0F7AA919EE9603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 017686cee3404c45074472ab953841eee9670c51b544e359e0a811de38a25678
MD5 93044adf8b898ea4dd04536a67941f2e
SHA1 9fd7a776951537bc02f813afb684fd36e096c746
SHA512 9b42bfc524731a5d53147c31379bb1b6de2a5474f64f63ded26fc2fafce60c151bb0836c0a900baa2c662e0e7e5de171bd0bdb0c70ae6703a959971b4785da7a
SSDEEP 24576:4gi9/WUPPWcLi+CWS350tNBzAxj0cCknn:4b9/WU3rLi+CWS35OPOj0cCknn
TLSH
T1EC452700B66AC74FC66940321E36D6CDA7707D41EE44AF0773C88B3FD576659BAE2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.3MB
SHA256 6201be9ac9ef52a85ca5ffb9bea7dcf1f7330c374fc46773335d3a3dd845cb86
MD5 ac4869d6b9027dfbb4aba8ff369d9324
SHA1 a022f5837f33aacf9b2c90cb45ac746542a0942c
SHA512 24c984d595fc7ac329be4392c3d2584ea0842d5e02df8a365c192de95ee2c94b566745ccdd4788269711e77427ffc80a4dde185c57939df0f86995f7b27b9f5f
SSDEEP 24576:KaGPpG2MCWS3i42Qchz0IAlwoiT6MtZuCIOa06hgRwKCMx8b1U:KaGPpG2MCWS3i42Q6ArKt2MtZuCIOa0D
TLSH
T14D55DA40E436A38FD0BB6131072A5F8C77A4EC46BB456F26B788457ED82A705A1BC3D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 607B
SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
MD5 76b78ed7ff6273215b134d6a6488035d
SHA1 9e7a11ffb68d027036302eccd4c22315054843a9
SHA512 9919504cd4d8c0757abff8da4bbad1c4b6532f81d290c736fc5624ef66de45e6a9e29a8290854ae554d5bdfc5291f1ea81ae62d1b25846bfbcf1515e2ec3e4f1
TLSH
T174F0DC53CBD6536BD527223CC8E207E1FA70E2719E81212386106F2D6CB77241E474B4
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 423ce56515ad688f8cf439735dcdb675e9aa6429a4028df94791ef3e55265b6d
MD5 0408ba668eacfe54f2f56305aadfa1c1
SHA1 d199c95ce030eea9833dd095bc6778ab02e37673
SHA512 f9aaf1a66ebd751d595dbc176cd9b1f54a79390ca596a0f1df0762e39a3344ce82588a63499af1e822911fcb5fc90c5a02b137ff9e646cfb87c6be0bbee6eb3f
TLSH
T1C2D0122272114178C41030334482EA4D0400E60B40464004643CC51E5E540A00E23449
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7541af9dfc11a9a57d64097ac935d54164553f2593f165ef6868f6da6f6e4183
MD5 db00ed3c3306bf657f42238fcb1c7bee
SHA1 eb2e2136a9c49b2268127ce2bba9a793923ad3df
SHA512 7ae4a7b48994fe69f79f39807378cb011bc22cf7cc899b6d2169642b4d4757fc432dc7993d73f049c380b0b7a92e9f88ff4ccbd2223fc0adacce4d96c01a08ec
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

87f5fefb-dc52-4af5-bede-f67f350dee55.tmp

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\Default\87f5fefb-dc52-4af5-bede-f67f350dee55.tmp
Size 6KB
SHA256 4f883082082a6311df1aa2043c5abc17fe267f23df7e13b7303e4af673ffe083
MD5 01a4e737b6749e13b8f58dc8e4cf9aed
SHA1 d721b9f362042591078dc6da0659071791581481
SHA512 57b4fd34a0cb9e2ac249f9c9a8a9da3ccce221d8ab7e35c04d126248ce07c2b3f0d9d0b54eed0268fd1c7dc7ed1dfc7bd357934edaa991de48f14930ca6fd147
SSDEEP 96:stX/d9mGhXtb9nkpo5h16Z5Sms7/x+6MhmuecSyp1ejeIK+g/0a28XM1C7K:stvDLkoKDsV+F2ypQj4fG6K
TLSH
T145D1B7065E24797B4CC6E119BA39BB17E2F9603261E11E58EBF84A1C05DFACC2317D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 fd057d06b8af811c474adeacb71e8e7f8da9df1743de7d27767046c49477e6b8
MD5 a966029c52fec294a943fd15ef0ce645
SHA1 032b265dc409e32c9634ef4c0afd9af246fc9a0f
SHA512 340d20320a2afb5c0859fa2861397053bf15459eaaa4bf3a0b05645334b9b3fa86e9765c5f8cf2f08554c831216e9c67bb74cd12676a6ff427d19796b2240c3d
TLSH
T19BB00278A1114463C72D137474E79BC1B7324EACC21B2D31C4D205BFDD3E396D555542
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598246.TMP

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe598246.TMP
Size 48B
SHA256 75da269a4e7f7faf5026eebf6bf9323baec1ee058c8f284980e01f0870bbab17
MD5 91a2d469da98e1e6c602ce70feb22a8c
SHA1 7c8d06029b2fa8da74576f7a8d0e36ad86c21b58
SHA512 869c275b2ed06228c9b9d01e43f9657c24c2a2bb5e2f2d79c7b121a42c5c8d22a6132eea18fad5be66e14715e4ad8831db6ff50c016a0d38bce6294460a2a359
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a4dc3.TMP

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\Default\Network\Network Persistent State~RFe5a4dc3.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 70ec821b31f0dc711bca10bfc9ca907a4ad2b84d871e4a78d322444363eac9a9
MD5 5bd18f30ff7f8ef43b591642bc10a8eb
SHA1 d6addf36d48c8f241a576f6095ecf364951d4042
SHA512 41e2c5dee9eff40aaee8df49c33704b6396e8cc2821d4f7b0fbb4180f3774531e3502f3d7f9968cbe08ebe2c1871ef04d8c31d3129a9c4d37ecca6ee9d420236
SSDEEP 96:stX/d9mGIGXtb9nkpo5h16Z5Sms7/x+6MhmuecSyp1ejeIK+g/Zwb28XM1C7K:stvDZkoKDsV+F2ypQj4gG6K
TLSH
T17DD1B6065E24797B8CC6E119BA39BB17E2F5607261E11E48EBFC4A1C05DFADC231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\Local State
Size 2KB
SHA256 6bcf5bab5214641070a7d70b05d9c5674e270b88fd2fb3484e22ef2ff702be93
MD5 fd85cc872feabbbceadd03094bf0ea08
SHA1 3bbf210c0140c7b2ef4a264f68800638afecdb25
SHA512 ec113042b207f14f1278f6cfb3afc4d43d303fafe3f4be912ab9e9a2e937bafae9a37da0a5633a2954cbd343ab99fa3f7bb001c490cb606ec69dadfe54ad7d1b
TLSH
T19151A9336850AB3789E3D60A79167F53CAB550A59BE22F94A9EC0B0C02CF90C1707C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\Local State
Size 3KB
SHA256 f135339eeef238546284d59f146c0f31119ada64b4bb4c505d4f8cfcf790b487
MD5 d8f77576a0e700066e274583c1cd39d3
SHA1 88d854638fffec519c81a6e5d2159afd542814da
SHA512 c4dfbf9f864ab03777fdb53a833e0b8f15be985bb40035d648db5feba39fb7f87c3b967bc0e10ce212cc944228a4b9e55bce2ea7428db9bea77f9bdb00f27690
TLSH
T1FC71857B6960A9374DE2DA0579462F16A7A54037D6D57FA8E9FC0F0C02CB64C1313C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\Local State
Size 15KB
SHA256 b1ec6be3e91a6da98817e1458107a33dc95a81bda3262f05a5e955528c68229f
MD5 b97c2addc6babdc942e8e081f4996c36
SHA1 2409f4496877c30c99f1d7f5b50bd81914df0e61
SHA512 f529253d428e053945573a88befc44b51790fbd77e78b83cbbdafcd29e3e1bfbeccaed7b84baeddeff310a8c1acb11db0824d8fbe6b41b902ba01f44b25493f9
SSDEEP 192:osrSABD6KZenoX+pshLTGbdna37W6h6DWYP9E4Y53yJGPa/a7vnNBSSseoDUDVuP:osrv+89zHqlDNP9oid6NBSnq7Px3j0N1
TLSH
T14E72AE33D57CA7378DF3D50AB48A6A0B6BB850A652C21BA4E9A95F4C42CF4CD2303D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59235d.TMP

Path C:\Users\Admin\AppData\Roaming\2026-06-26_364aad8357bec0d900bce3569027f908_amadey_coinminer_dosia_frostygoop_glassworm_hellokitty_h.exe\EBWebView\Local State~RFe59235d.TMP
Size 1KB
SHA256 1e275f1fae53a9480c5113a72bee865a8dac8c8bc8a026ea0d2d114843ffee87
MD5 38a85dad0802567d1bfc5cbd50cfabdd
SHA1 ed687f917b526ed3792b686380dac04b1ff958c6
SHA512 926eab280d7a690c8d5903e7d5a3f51933e1c6699e75482a302408f8efbb2e3cda60ed7b5f004ca71c1ebe439585b2ba745ae2ed44e343e891990788033e2248
TLSH
T12D31277795955B3299D2F65B3112EF575EB040BA87A15F88B5EC4A0C03CF40D662BC33
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 6439f9f40d1da555846b3a820b3e055588d8bece2e3deb1a1b1f28b747d56fbb
MD5 144f970dcdcc6c20b98fab00e0b832a9
SHA1 6e651c38d977549e522ace331c629bf9e7834b63
SHA512 5344fefc25dbe84d3f212430a2ae8936f4bf7386cb56c95841c69159341b4fe39640268d08483e8a4f830ba8dc307f6a6228417561263f5acd6cf3ec551126c4
SSDEEP 12288:py76LDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:IRNyBo4kx929bL3Hnx
TLSH
T18E452312975C663AFA7D3BB0645EC124C839BC4D0F50D6DBEE1258BA59BCED28E30607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 0f3cff94d7d017a94f0ced8fff86a089c19dfb4803e7d2c964f024f137b7621d
MD5 7f577c533c67759d946e7e344a4ab113
SHA1 b08e42206bc88fcebdd59e69d1e868cc27c914a9
SHA512 73dfb34d2c60f6609adc1031b3e5ea9393d9fe7b21c27a5ecb08e4c91da293996ca0efcebe7647f0efa97338385505c62b33ed225508fbd709813edad0d6e7b9
SSDEEP 24576:bgb6bmBIi49WNNFpg1rSvFv7bYrNyBo4kx929bL3Hnx:bgb4mBIBhGFxB+kn3Hnx
TLSH
T1DA65AE1E22EC02F5E0F9E2B89DAA4417D6B278160731D2DF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 25bc0d7e06c641b23d28627779f33c56f6fce716e178110a5fea871be60aa95a
MD5 28e201af086134851327a910ee404d0c
SHA1 e799b539d2e8d0ec1396d637ea29304f532e5ae1
SHA512 043d2257cabe29742608fec2e5535475afb444621e142c0611c08c8a61c8352daeaf1a2ac5c9a369590af752822078bee1a16c9a67eaacbd4e86796fb55b05f7
SSDEEP 24576:iG88u8FpJqH1Jzria7/mCNyBo4kx929bL3Hnx:57ZFPqVAa7/cB+kn3Hnx
TLSH
T19C85F12577E401F1D47BE13889864663F6B1B8150364EFDF0BA88A661F23BE54B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 295bad9e789a8eca44bff557ce962a44b5d1f3ca36753396eee4eaae0297ebcd
MD5 89e92dd66447473db978915d347b0eed
SHA1 ef5df8f031358dfe2392c4a803cddd90906a7f87
SHA512 b9e79cfe3fe4992cb61985b2dae240e1643c5854a7e67e0550d92001528b929428074591ebb28fddf68d9360900901cbd7a8dc392adb1693868064846f9fb732
SSDEEP 49152:CBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjVB+kn3Hnx:NG05lO43bq+k
TLSH
T15CD5CF6A62EC11F9D0BBD17CD9C6460BEBB23815033556CF02A486A91F27FF45A7E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 9da45c65146b51b1f25f8e685ff4f64762447d8b77b06127cfc69d0349040ce9
MD5 9916c1a08150a27b5041eea44586ec61
SHA1 3055046c4b14047859ab95e4c49f2b5cd348af6c
SHA512 b8b305005f9784aaf746215283ac5ff8556d67482c68b6940bb9ad40cfbb20dc40557815e9952bfb3d146773f92aabd9ddee4fdb6cb82522ae7c1eefc1127eb9
SSDEEP 24576:Rfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnQNyBo4kx929bL3Hnx:xa5POZ3BJt2pasx2+mdB+kn3Hnx
TLSH
T1DF65AF5EA6FC01D5E579D17CC583861AE5B1342653329BCF022182BE3F27EE89E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 79f11c5cda75c1738c8d42e07718448ff24e9df1746023e1c709ab774226d865
MD5 5fd72449d1a747f3fc4042d6f49a3bfe
SHA1 6fea338e9723b020305191c7c1ab7d60908ab9d5
SHA512 ac3612a1fd5c3d14a547920db6b17a17db5baf89efdde6b18e161793c0bc7dedf8701f1bda8c016298a489d3ec87bccf3653f00e9bb69f4a6e72d130e765caab
SSDEEP 24576:6NcwHdjbyQ4nLC18lb/EOjowL7FkaNyBo4kx929bL3Hnx:6Nc/zEOVHF8B+kn3Hnx
TLSH
T163858B1623E901E4F1BBE1BE89679546FA71786917308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5360_511325746\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 fd5ade416efeb5fbaf466e14cf8e7ed418f2363a4fc37adb0c098dbcfa7b8a79
MD5 53d344abc6d5653e1ddecb8995f8dda3
SHA1 94e8ddab036a6289b164a43437621edafb4cce4d
SHA512 e783b75b6bea4a0de3b1e48b3b64e87a5dfdbc4e08139dcc5824af4abc4b9b6d9237faf998c63bbd6a0b974f9742f91c7a00cec4437f3f1b1d8cf3016f0ac2b1
SSDEEP 24576:WTkNvNnaFeYhJNtmZBmENyBo4kx929bL3Hnx:WTMwBtOm/B+kn3Hnx
TLSH
T1B355AF2EB6B846E4D1FEC6B49D238512EA727851073293CB9390C13F0E679D89E75F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 bf00dfd5c6bc43b004f88a78dcdbefd05d39f88ddf2f1c19a398e1e436dfd63c
MD5 2ef3981f9543a94c59976894e3e1f502
SHA1 33e0ea718417e30dbe8f33138ddb863e2c4e2c1f
SHA512 3016b73e1cd1381b51289a65ca3baf568f082c1c54e0b5a228d877047937e253cc6af1cdc6da6c37feaa6d3f37ecdc4a1ee5e89625ccd48dec5ed73423af0100
SSDEEP 12288:UHvUrBFrEjwaQRLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf53nHVoTOyEx:UPUr+NQuNyBo4kx929bL3Hnx
TLSH
T10E65F21F22AC18E5F67AB17C85868609E771B8560712D2CF02E1817E4F77EE8BD39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 92cf82724d7a29cfeb85863f4517bc512b218d6b68a2f84a170820fc9e9369ea
MD5 a6730a764c3d86d3bd28a9dc581ccd83
SHA1 02a956e653b2a73c3b92a25549c8295cd11923d9
SHA512 751c47288e3e552895f8ef6b80d118a83c636be521d9c112ea0d440a8a7c286276cc0fe103b968fa905e375081bceb1c353f8adfa63927dafcf9128923703c1a
SSDEEP 12288:6QcMxWDXN1Dp/fshBItT1IQgAGLDAptNyvUgXZ32dT4ePc7N29Cxs5+j2QNbxf5D:oD3FHshBIYQgAFNyBo4kx929bL3Hnx
TLSH
T19D75E13EE75C00E4E57BD1BCDA538906E67138AD072266DB0694C1BA1F6BEE46D39F00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/884-736-0x0000000008340000-0x00000000083A4000-memory.dmp

Download

memory/1180-245-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1180-243-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1180-251-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1180-255-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1180-253-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/1612-242-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1612-34-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1612-27-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1612-33-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1612-26-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2472-510-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2472-261-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2472-267-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/2472-260-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/2516-45-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2516-48-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2516-39-0x0000000001B00000-0x0000000001B60000-memory.dmp

Download

memory/2516-50-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/2516-38-0x0000000140000000-0x0000000140174000-memory.dmp

Download

memory/2736-88-0x0000000000400000-0x00000000011A1000-memory.dmp

Download

memory/2736-0-0x0000000000180000-0x00000000001E0000-memory.dmp

Download

memory/2736-9-0x0000000000400000-0x00000000011A1000-memory.dmp

Download

memory/2736-6-0x0000000000180000-0x00000000001E0000-memory.dmp

Download

memory/3060-505-0x0000026EFA710000-0x0000026EFA7C2000-memory.dmp

Download

memory/3060-218-0x00007FF992380000-0x00007FF992381000-memory.dmp

Download

memory/3128-69-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3128-71-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/3128-77-0x0000000000B60000-0x0000000000BC0000-memory.dmp

Download

memory/3128-445-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3428-117-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/3428-126-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/3428-504-0x0000000140000000-0x00000001401DD000-memory.dmp

Download

memory/3428-119-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/4352-65-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4352-59-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4352-398-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4352-58-0x0000000140000000-0x000000014016E000-memory.dmp

Download

memory/4512-14-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4512-13-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4512-20-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4512-21-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4512-116-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4708-537-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4708-92-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4708-99-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4708-483-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4708-93-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/4708-538-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4796-503-0x00000298C29D0000-0x00000298C2A82000-memory.dmp

Download

memory/4796-189-0x00007FF992380000-0x00007FF992381000-memory.dmp

Download

memory/4796-1075-0x00000298C29D0000-0x00000298C2A82000-memory.dmp

Download

memory/4952-829-0x00007FF991A80000-0x00007FF991A81000-memory.dmp

Download

memory/4952-828-0x00007FF9921C0000-0x00007FF9921C1000-memory.dmp

Download

memory/5292-555-0x0000022C801E0000-0x0000022C802E0000-memory.dmp

Download

memory/5292-574-0x0000022C83930000-0x0000022C83950000-memory.dmp

Download

memory/5292-589-0x0000022C83B90000-0x0000022C83BB0000-memory.dmp

Download

memory/5292-575-0x0000022C93E20000-0x0000022C93F20000-memory.dmp

Download

memory/5292-603-0x0000022C945A0000-0x0000022C945C0000-memory.dmp

Download

memory/5292-553-0x0000022C801E0000-0x0000022C802E0000-memory.dmp

Download

memory/5292-554-0x0000022C801E0000-0x0000022C802E0000-memory.dmp

Download

memory/5380-490-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5380-111-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5380-487-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5380-488-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5380-104-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/5380-105-0x00000000007E0000-0x0000000000840000-memory.dmp

Download

memory/5608-871-0x00000216BABD0000-0x00000216BABD1000-memory.dmp

Download

memory/5608-874-0x00000216BABD0000-0x00000216BABD1000-memory.dmp

Download

memory/5608-873-0x00000216BABD0000-0x00000216BABD1000-memory.dmp

Download

memory/5608-872-0x00000216BABD0000-0x00000216BABD1000-memory.dmp

Download

memory/5608-875-0x00000216BABD0000-0x00000216BABD1000-memory.dmp

Download

memory/5608-870-0x00000216BABD0000-0x00000216BABD1000-memory.dmp

Download

memory/5608-866-0x00000216BABD0000-0x00000216BABD1000-memory.dmp

Download

memory/5608-864-0x00000216BABD0000-0x00000216BABD1000-memory.dmp

Download

memory/5704-525-0x000001F123220000-0x000001F1234AB000-memory.dmp

Download

memory/6016-89-0x0000000000400000-0x0000000000535000-memory.dmp

Download

memory/6016-465-0x0000000000400000-0x0000000000535000-memory.dmp

Download